@bivy/bivy 0.17.3-staging.9 → 0.18.0

package/dist/server.js

@@ -32,7 +32,8 @@ import { AppRegistry } from "./apps/registry.js";
 import { AppGateway } from "./apps/gateway.js";
 import { RemotePreview } from "./apps/remote-preview.js";
 import { AppService } from "./apps/service.js";
-import { DisplayHost } from "./apps/display.js";
+import { pngSize, reviewHint } from "./apps/review.js";
+import { createDisplayHost } from "./apps/display.js";
 import { createAppCommands } from "./controllers/app-commands.js";
 import { bindClientCommandRoutes } from "./http/client-command-routes.js";
 import { collectDiscoveredSessions, planNativeAdoption } from "./runtime/native-session-discovery.js";
@@ -114,6 +115,9 @@ import { listInstalledPlugins } from "./plugins/store.js";
 import { createCapabilitiesController } from "./controllers/capabilities.js";
 import { createAccessDeviceController, createLinkedDeviceController } from "./controllers/devices.js";
 import { createSessionControlCommands } from "./controllers/session-control.js";
+import { createPresenceCommands } from "./controllers/presence-commands.js";
+import { createArtifactCommands } from "./controllers/artifact-commands.js";
+import { PresenceBook, deviceFrom } from "./session/presence.js";
 import { createForkCommands } from "./controllers/fork-commands.js";
 import { createGithubCommands } from "./controllers/github-commands.js";
 import { createCredentialCommands } from "./controllers/credential-commands.js";
@@ -918,6 +922,9 @@ function harnessDirFor(record) {
  *  changes card — acceptable for a best-effort diff, and the prompt no longer
  *  waits on git. Never throws into the prompt path. */
 function harnessBeginTurn(record) {
+    // A run starts: review cards measure what the app looked like before it.
+    appService.runStarted(record.id);
+    record.runReview = undefined;
     const dir = harnessDirFor(record);
     record.harnessTurnReady = undefined;
     record.harnessTurnFinished = false;
@@ -949,9 +956,12 @@ function finishHarnessTurn(record) {
     if (record.harnessTurnFinished)
         return;
     record.harnessTurnFinished = true;
-    void harnessEndTurn(record).finally(() => {
+    const ended = harnessEndTurn(record);
+    void ended.finally(() => {
         void replication.onTurnComplete(record.id);
     });
+    // After the diff has bumped preview revisions: decide on this run's review card.
+    record.runReview = ended.then(() => appService.runEnded(record.id)).catch(() => undefined);
 }
 async function harnessEndTurn(record) {
     const previous = record.workspaceState === "dirty" ? "dirty" : "clean";
@@ -1676,6 +1686,19 @@ const sessionEvents = new SessionEventCoalescer({
 function broadcastTuiState(sessionId, active) {
     broadcast({ type: "terminal.tui", sessionId, active });
 }
+// Device handoff (src/session/presence.ts): which device last drove each
+// session and the draft it left, so the next device can pick up from there.
+const presenceBook = new PresenceBook();
+function publishPresence(presence) {
+    broadcast({ type: "session.presence", presence });
+}
+function notePresence(sessionId, device, via) {
+    if (!sessionId || !device)
+        return;
+    const changed = presenceBook.drove(sessionId, device, via);
+    if (changed)
+        publishPresence(changed);
+}
 // Terminals opened by relay clients (phone/web over the relay). Output is emitted
 // via the relay tagged with termId; clients filter by it. (Per-client unicast
 // is a known future hardening step.)
@@ -1760,10 +1783,15 @@ function referencedAttachmentHashes() {
     // `scan`, not `entries`: this visits every session ever created, and must not pin
     // each one's full log in the event-log cache.
     for (const id of ids) {
-        for (const entry of eventLog.scan(id, ["attachment", "outbound-attachment", "inline-image"])) {
+        for (const entry of eventLog.scan(id, ["attachment", "outbound-attachment", "inline-image", "app-review"])) {
             if (entry.bivyKind === "attachment")
                 for (const ref of entry.refs)
                     hashes.add(ref.hash);
+            else if (entry.bivyKind === "app-review") {
+                for (const shot of [entry.review.shot, entry.review.before])
+                    if (shot)
+                        hashes.add(shot.hash);
+            }
             else if (entry.bivyKind === "outbound-attachment" || entry.bivyKind === "inline-image")
                 hashes.add(entry.ref.hash);
         }
@@ -1819,6 +1847,20 @@ const replication = new ReplicationService({
     },
     log: (m) => console.error(`[replication] ${m}`),
 });
+/** Take over a replicated session on this node (manual promotion). Once it
+ *  wins the epoch it is this node's session, not a standby copy: retag it so
+ *  every client stops offering "Continue here", and push the new list. */
+async function promoteReplicaHere(sessionId) {
+    const epoch = await replication.promote(sessionId, identity.nodeId);
+    if (epoch === undefined)
+        return undefined;
+    const source = metadata.getSession(sessionId)?.source;
+    if (source?.startsWith("replica"))
+        metadata.upsertSession({ id: sessionId, source: source.replace(/^replica/, "promoted") });
+    broadcastSessionsList();
+    scheduleAdvertise();
+    return epoch;
+}
 // Retire the legacy overlay sidecars. The append-only log is the sole overlay
 // store now and every session was migrated into it by the prior release's boot
 // migration (.migrated-overlays-v1), verified complete on-disk before this landed.
@@ -1911,10 +1953,13 @@ const dedupeSessionNew = (requestId, create) => sessionNewDedupe.run(requestId,
 // generic key->promise cache as above, reused for a different key) — see
 // issue #154's queued follow-ups. A client that isn't sure whether a queued
 // item's send actually reached the node before the socket dropped (see
-// AppController.retryStuckFollowups) resends it verbatim after reconnecting;
+// FollowupCoordinator.retrySending) resends it verbatim after reconnecting;
 // this makes that safe by collapsing a retried clientMessageId onto the
-// original broadcast + turn instead of double-prompting the runtime.
-const promptDedupe = createSessionNewDedupe();
+// original broadcast + turn instead of double-prompting the runtime. The key is
+// kept for a day, not session.new's 10 minutes: a phone backgrounded mid-send
+// can reconnect long after the turn ended, and an expired key turned its
+// retry into a fresh, duplicate turn at the bottom of the chat.
+const promptDedupe = createSessionNewDedupe({ ttlMs: 24 * 60 * 60_000 });
 const dedupePrompt = (clientMessageId, run) => promptDedupe.run(clientMessageId, run);
 // Preview traffic has isolated per-view origins and a private gateway. Relay
 // delivery needs no listener; direct ingress is an optional operator override.
@@ -1942,7 +1987,56 @@ const appSignIn = (view, pagePath) => {
 const appGateway = process.env.BIVY_APPS_ORIGIN ? new AppGateway(appRegistry, process.env.BIVY_APPS_ORIGIN, appReturnOrigins, appSignIn) : undefined;
 const remotePreview = new RemotePreview(appRegistry, appReturnOrigins, appSignIn);
 // Desktop app views: one private display per view, started on first open.
-const appDisplays = new DisplayHost();
+const appDisplays = createDisplayHost(appDir);
+/** Review cards: screenshots become encrypted attachments (fetched by hash
+ * like any image), and the card is logged so it survives a reload. A card
+ * that updates moves to the end of the run; an expired one stays put. */
+function createReviewSink() {
+    const anchors = new Map();
+    const emit = (review, anchor) => {
+        const record = resolveSession(review.sessionId);
+        if (!record)
+            return;
+        const at = anchor ?? { afterMessageCount: record.session.getMessages().length, createdAt: Date.now() };
+        anchors.set(review.id, at);
+        eventLog.appendAppReview(record.id, { ...at, review });
+        broadcast(stampSessionEvent({ type: "session.event", sessionId: record.id, event: { type: "app_review", id: review.id, review } }));
+    };
+    const store = (png, name) => {
+        if (!png)
+            return undefined;
+        try {
+            const ref = attachmentStore.put(png, { name, mimeType: "image/png", kind: "image" });
+            return { hash: ref.hash, size: ref.size, ...pngSize(png) };
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return {
+        publish(review, images) {
+            const card = { ...review };
+            const shot = store(images.shot, `${review.name} ${review.path}.png`);
+            const before = store(images.before, `${review.name} ${review.path} before.png`);
+            if (shot)
+                card.shot = shot;
+            if (before)
+                card.before = before;
+            emit(card);
+            return card;
+        },
+        expire(review, keep) {
+            const record = resolveSession(review.sessionId);
+            for (const hash of [review.shot?.hash, review.before?.hash]) {
+                // Never delete bytes anything else in the chat points at.
+                if (hash && !keep.has(hash) && !record?.seenAttachmentHashes?.has(hash))
+                    attachmentStore.remove(hash);
+            }
+            const { shot: _shot, before: _before, ...rest } = review;
+            emit({ ...rest, expired: true }, anchors.get(review.id));
+        },
+    };
+}
 const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     start: async (spec) => {
         let failure = "Could not start the app terminal.";
@@ -1957,7 +2051,37 @@ const appService = new AppService(appRegistry, appGateway ?? remotePreview, {
     },
     has: (id) => terminals.has(id),
     close: (id) => { terminals.close(id); },
-}, { screenshots: { enabled: appScreenshotsEnabled }, displays: appDisplays });
+}, { screenshots: { enabled: appScreenshotsEnabled }, displays: appDisplays, reviews: createReviewSink() });
+// A reviewer's note shows up in an open Apps sheet without reopening it, and
+// the owner gets one push per burst of notes on a view ("2 notes on
+// Storefront"), which opens the Apps sheet at that app. Counts, names and IDs
+// only: the note text never goes through push.
+const NOTES_NOTIFY_MS = 20_000;
+const noteBursts = new Map();
+appRegistry.on("notes", (viewId) => {
+    const entry = appRegistry.getView(viewId);
+    if (!entry)
+        return;
+    broadcast({ type: "apps.changed", sessionId: entry.app.sessionId });
+    const pending = noteBursts.get(viewId);
+    noteBursts.set(viewId, (pending ?? 0) + 1);
+    if (pending !== undefined)
+        return;
+    setTimeout(() => {
+        const count = noteBursts.get(viewId) ?? 0;
+        noteBursts.delete(viewId);
+        const current = appRegistry.getView(viewId);
+        if (!current?.notes?.length || !count)
+            return;
+        const notes = count === 1 ? "A note" : `${count} notes`;
+        void sendNotificationHint({
+            kind: "app_notes", sessionId: current.app.sessionId, targetSessionId: current.app.sessionId,
+            title: `${notes} on ${current.view.name}`,
+            body: `Someone reviewing ${current.app.name} left ${count === 1 ? "a note" : `${count} notes`} — tap to read ${count === 1 ? "it" : "them"}.`,
+            apps: { appId: current.app.id },
+        });
+    }, NOTES_NOTIFY_MS).unref?.();
+});
 const RELAY_COMMANDS = {
     ...createAppCommands(appService, (id) => { const record = resolveSession(id); return record ? harnessDirFor(record) : undefined; }, (app) => {
         const record = resolveSession(app.sessionId);
@@ -2000,6 +2124,12 @@ const RELAY_COMMANDS = {
         const meta = attachmentStore.readMeta(hash);
         ctx.reply({ type: "attachment.data", requestId, hash, mimeType: meta?.mimeType ?? "application/octet-stream", name: meta?.name, data: bytes.toString("base64") });
     },
+    ...createArtifactCommands({
+        sessionIds: () => new Set([...metadata.listSessions().map((session) => session.id), ...[...openSessions.values()].map((record) => record.id)]),
+        scan: (id) => eventLog.scan(id, ["outbound-attachment"]),
+        stored: (hash) => attachmentStore.getPath(hash) !== null,
+    }),
+    ...createPresenceCommands(presenceBook, publishPresence),
     ...createSessionControlCommands({
         resolve: (sessionId) => resolveSession(sessionId),
         pause: pauseSession,
@@ -2763,10 +2893,9 @@ const RELAY_COMMANDS = {
         const sessionId = String(msg.sessionId ?? "").trim();
         if (!sessionId)
             return ctx.reply({ type: "session.promote.result", requestId, ok: false, error: "Missing sessionId" });
-        const epoch = await replication.promote(sessionId, identity.nodeId);
+        const epoch = await promoteReplicaHere(sessionId);
         if (epoch === undefined)
             return ctx.reply({ type: "session.promote.result", requestId, ok: false, error: "Promotion lost the epoch race" });
-        scheduleAdvertise();
         ctx.reply({ type: "session.promote.result", requestId, ok: true, sessionId, epoch });
     },
     // Ephemeral provisioning transport (node-broker path). A remote device that
@@ -2869,7 +2998,7 @@ const RELAY_COMMANDS = {
             relay?.sendEvent({ type: "integrations.updated", integrations: integrations.list() });
         }
     },
-    async prompt(msg) {
+    async prompt(msg, ctx) {
         const text = String(msg.text ?? "").trim();
         const { images, imageNotes, imageRefs, files } = attachmentsFrom(msg.attachments);
         if (!text && !images.length && !files.length)
@@ -2910,6 +3039,7 @@ const RELAY_COMMANDS = {
             broadcast({ type: "session.error", sessionId: record.id, error: record.tuiRefreshing ? "This session is returning from the terminal. Try again in a moment." : "This session is open in the terminal (TUI). Close the TUI to chat here." });
             return;
         }
+        notePresence(record.id, deviceFrom(msg.device), "chat");
         touchSession(record);
         // Now that the session (and its workdir) exists, write file attachments to
         // disk and fold their path notes into the prompt the agent actually sees.
@@ -2921,6 +3051,14 @@ const RELAY_COMMANDS = {
         eventLog.appendAttachments(record.id, promptText, [...imageRefs, ...fileRefs]);
         const agentPrompt = promptForAgent(record, promptText);
         const cmid = typeof msg.clientMessageId === "string" && msg.clientMessageId ? msg.clientMessageId : undefined;
+        // A retry of a prompt we already took: the caller missed our echo (that is
+        // why it retried), so acknowledge it again — to the caller only, since
+        // other clients already rendered the first one. Without this the client
+        // keeps the message "sending" and resends it on every reconnect.
+        if (promptDedupe.has(cmid)) {
+            ctx.reply({ type: "session.user_message", sessionId: record.id, text: promptText, clientMessageId: cmid, retry: true });
+            return;
+        }
         void dedupePrompt(cmid, async () => {
             broadcast({ type: "session.user_message", sessionId: record.id, text: promptText, clientMessageId: msg.clientMessageId });
             void sessionNamer.maybeNameSession(record, promptText);
@@ -3052,6 +3190,8 @@ async function handleRelayMessage(msg) {
         // Fallthrough for kinds not in RELAY_COMMANDS: terminal.* frames go to the
         // PTY manager; anything else is an unknown client message.
         if (typeof msg.kind === "string" && msg.kind.startsWith("terminal.")) {
+            if (msg.kind === "terminal.attach")
+                notePresence(terminals.meta(String(msg.termId ?? ""))?.sessionId, deviceFrom(msg.device), "terminal");
             // The relay is a single tunnel with no per-remote-client identity at this
             // layer, so every relay-tunneled client shares one size slot. That still
             // keeps them distinct from each local socket, so a PTY shared between a
@@ -3944,6 +4084,19 @@ function sessionNotifyLabel(record, fallback = "A session") {
         return `${agent} · ${branch}`;
     return agent || branch || fallback;
 }
+/** How long the "finished" notification waits for a review card. */
+const DONE_REVIEW_WAIT_MS = 30_000;
+async function doneNotification(record) {
+    const label = sessionNotifyLabel(record);
+    const review = await Promise.race([record.runReview ?? Promise.resolve(undefined), new Promise((r) => setTimeout(r, DONE_REVIEW_WAIT_MS))]);
+    const base = { kind: "session_done", sessionId: record.id, targetSessionId: record.id, title: "Session finished" };
+    // No card, but the session has a preview: the notification offers Show me.
+    const showMe = appRegistry.list(record.id).some((app) => app.views.some((view) => view.kind === "web"));
+    if (!review || review.expired)
+        return { ...base, body: `${label} finished — tap to review the result.`, ...(showMe ? { showMe } : {}) };
+    const hint = reviewHint(review);
+    return { ...base, title: `${label} finished`, body: hint.body, review: hint.review };
+}
 async function sendNotificationHint(input) {
     if (!sessionAdvertiseTarget)
         return;
@@ -6274,6 +6427,21 @@ function rememberSession(record) {
     persistSessionMetadata(record);
     recordSessionLocation(record);
     enforceOpenSessionCap(record.id);
+    // Opened while a `bivy run` pinned to it is live (e.g. `bivy resume` on the
+    // laptop, then the chat on a phone): the terminal owns it until it ends.
+    runTerms.adoptLiveRun(record);
+}
+/** The open session a run's pinned id refers to — by Bivy id or by the
+ *  runtime's own session ref. Unlike resolveSession, never the active one. */
+function findOpenSession(ref) {
+    const direct = openSessions.get(ref);
+    if (direct)
+        return direct;
+    for (const record of openSessions.values()) {
+        if (record.sessionFile === ref)
+            return record;
+    }
+    return undefined;
 }
 // Keep the number of live (in-memory) sessions bounded. Idle-close already
 // trims over time, but a burst of opens within the idle window could pile up
@@ -7692,13 +7860,10 @@ function attachSessionListeners(record) {
                 });
             }
             else if (!record.isWorking && !record.remoteActive && clients.size === 0 && (relay?.clientCount ?? 0) === 0 && (record.backgroundTaskCount ?? 0) === 0) {
-                void sendNotificationHint({
-                    kind: "session_done",
-                    sessionId: record.id,
-                    targetSessionId: record.id,
-                    title: "Session finished",
-                    body: `${sessionNotifyLabel(record)} finished — tap to review the result.`,
-                });
+                // Nobody is watching: the one "finished" notification also says when
+                // the app changed, and opens its review card. Waits (bounded) for the
+                // card; the hint carries IDs only, never the screenshot.
+                void doneNotification(record).then((hint) => sendNotificationHint(hint));
             }
             // Any turn that didn't schedule another resume broke the limit streak —
             // clear the durable counter so a future limit starts with a full budget
@@ -8652,10 +8817,17 @@ const runTerms = createRunTerminals({
     sendNotificationHint: (hint) => void sendNotificationHint(hint),
     createSession: (workspace, sessionFile, opts) => createSession(workspace, sessionFile, opts),
     resolveSession: (id) => resolveSession(id),
+    findOpenSession: (ref) => findOpenSession(ref),
     sessionBusy: (record) => sessionBusy(record),
     sessionTerminalsRecord: (sessionId, val) => sessionTerminals.record(sessionId, val),
     sessionTerminalsForget: (sessionId) => sessionTerminals.forget(sessionId),
-    upsertSessionMetadata: (patch) => metadata.upsertSession(patch),
+    upsertSessionMetadata: (patch) => {
+        const input = patch;
+        // A run continuing a saved session (`bivy resume`) only moves its status;
+        // the session keeps its own name, source and agent.
+        const prev = metadata.getSession(input.id);
+        metadata.upsertSession(prev ? { id: input.id, status: input.status } : input);
+    },
     sessionListChanged: () => { broadcastSessionsList(); scheduleAdvertise(); },
     saveRunLog: (termId, log) => runLogs.save(termId, log),
     loadRunLog: (termId) => runLogs.load(termId),
@@ -11110,6 +11282,7 @@ app.post("/api/session/prompt", async (req, res, next) => {
         if (record.tuiTermId || record.tuiRefreshing) {
             return res.status(409).json({ error: record.tuiRefreshing ? "This session is returning from the terminal. Try again in a moment." : "This session is open in the terminal (TUI). Close the TUI to chat here." });
         }
+        notePresence(record.id, deviceFrom(req.body?.device), "chat");
         const session = record.session;
         const { note: fileNote, refs: fileRefs } = materializeAttachments(record, files);
         const promptText = [text, imageNotes.join("\n"), fileNote].filter(Boolean).join("\n\n") ||
@@ -11223,10 +11396,9 @@ app.post("/api/session/promote", async (req, res, next) => {
         const sessionId = String(req.body?.sessionId ?? "").trim();
         if (!sessionId)
             return res.status(400).json({ error: "Missing sessionId" });
-        const epoch = await replication.promote(sessionId, identity.nodeId);
+        const epoch = await promoteReplicaHere(sessionId);
         if (epoch === undefined)
             return res.status(409).json({ error: "Promotion lost the epoch race (another node owns it, or it isn't replicated)" });
-        scheduleAdvertise();
         res.json({ ok: true, epoch });
     }
     catch (error) {
@@ -11444,6 +11616,7 @@ wss.on("connection", (socket, req) => {
     // Stable id for this socket, keying its per-terminal size so several clients
     // sharing a PTY size it to their min (see TerminalManager.setClientSize).
     const clientTerminalId = `sock-${randomUUID()}`;
+    let socketDevice;
     socket.send(JSON.stringify({ type: "hello", activeSessionId: active?.id, activeSession: active ? { id: active.id, isStreaming: sessionBusy(active), sessionState: sessionState(active), lastActivity: active.lastActivity, workingStartedAt: active.workingStartedAt } : null }));
     // Authoritative version status on every connect: `latest` set means this node
     // is behind (banner shows); absent means up to date (banner + any "Updating…"
@@ -11468,6 +11641,12 @@ wss.on("connection", (socket, req) => {
             return;
         }
         if (typeof msg?.kind === "string" && msg.kind.startsWith("terminal.")) {
+            // A terminal client (`bivy run`/`bivy resume`) names its device once; typing
+            // into a session's terminal then makes it that session's driver.
+            socketDevice = deviceFrom(msg.device) ?? socketDevice;
+            if (msg.kind === "terminal.input" || msg.kind === "terminal.attach") {
+                notePresence(terminals.meta(String(msg.termId ?? ""))?.sessionId, socketDevice, "terminal");
+            }
             runTerms.handleTerminalMessage(msg, (event) => {
                 if (socket.readyState === WebSocket.OPEN)
                     socket.send(JSON.stringify(event));

package/dist/session/attachment-store.js

@@ -195,4 +195,19 @@ export class AttachmentStore {
             return null;
         }
     }
+    /** Delete one blob now, for a caller that knows nothing else references it
+     * (an expired review card's screenshot). Best-effort. */
+    remove(hash) {
+        const p = this.getPath(hash);
+        if (!p)
+            return;
+        try {
+            fs.unlinkSync(p);
+        }
+        catch { /* already gone */ }
+        try {
+            fs.unlinkSync(this.metaPath(hash));
+        }
+        catch { /* sidecar optional */ }
+    }
 }

package/dist/session/event-log.js

@@ -29,7 +29,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { normalizedIntermediateText, thinkingTextFromContent, mergeTranscript } from "./transcript-merge.js";
-import { APP_PUBLICATION_BLOCK, isAppReference } from "../apps/types.js";
+import { APP_PUBLICATION_BLOCK, APP_REVIEW_BLOCK, isAppReference, isAppReview } from "../apps/types.js";
 /**
  * Decompose a transcript message into serialization-independent "atoms": the
  * agent's own tool ids (unique + identical across serializations) and its text
@@ -241,8 +241,14 @@ function isAppPublication(value) {
     const entry = value;
     return entry.bivyKind === "app-publication" && typeof entry.id === "string" && typeof entry.createdAt === "number" && typeof entry.afterMessageCount === "number" && isAppReference(entry.app);
 }
+function isAppReviewEntry(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const entry = value;
+    return entry.bivyKind === "app-review" && typeof entry.id === "string" && typeof entry.createdAt === "number" && typeof entry.afterMessageCount === "number" && isAppReview(entry.review);
+}
 function isRecord(value) {
-    return isOverlay(value) || isBase(value) || isAttachment(value) || isOutboundAttachment(value) || isInlineImage(value) || isAppPublication(value);
+    return isOverlay(value) || isBase(value) || isAttachment(value) || isOutboundAttachment(value) || isInlineImage(value) || isAppPublication(value) || isAppReviewEntry(value);
 }
 /**
  * Fold attachment records into a text→refs list: last write wins per text (a
@@ -353,7 +359,18 @@ export function replayExtras(entries) {
         role: "assistant", content: [{ type: APP_PUBLICATION_BLOCK, app: entry.app }],
         id: entry.id, afterMessageCount: entry.afterMessageCount, createdAt: entry.createdAt,
     }));
-    return [...foldIntermediate(intermediate), ...foldTool(tool), ...replayOutboundAttachments(entries), ...publications];
+    // Last write wins: a card that updated in place shows its latest state, at its latest position.
+    const reviews = new Map();
+    for (const entry of entries)
+        if (entry.bivyKind === "app-review") {
+            reviews.delete(entry.id);
+            reviews.set(entry.id, entry);
+        }
+    const cards = [...reviews.values()].map((entry) => ({
+        role: "assistant", content: [{ type: APP_REVIEW_BLOCK, review: entry.review }],
+        id: entry.id, afterMessageCount: entry.afterMessageCount, createdAt: entry.createdAt,
+    }));
+    return [...foldIntermediate(intermediate), ...foldTool(tool), ...replayOutboundAttachments(entries), ...publications, ...cards];
 }
 /**
  * Fold the outbound (agent-sent) attachment records into time-anchored synthetic
@@ -648,6 +665,11 @@ export class EventLog {
         this.load(id);
         this.enqueue(id, `app:${entry.id}`, { ...entry, app: { ...entry.app }, bivyKind: "app-publication", createdAt: Date.now() });
     }
+    /** `createdAt`/`afterMessageCount` place the card; an expired card keeps its original place. */
+    appendAppReview(id, entry) {
+        this.load(id);
+        this.enqueue(id, `review:${entry.review.id}`, { bivyKind: "app-review", createdAt: entry.createdAt ?? Date.now(), afterMessageCount: entry.afterMessageCount, id: entry.review.id, review: structuredClone(entry.review) });
+    }
     appendOutboundAttachment(id, entry) {
         this.load(id);
         const record = {

package/dist/session/presence.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+//
+// Which device is driving a session, and the draft it left behind. This is a
+// soft lease, not a lock. Nothing is ever refused because another device drove
+// last; it only lets the next device say "you were on your Mac a minute ago" and
+// carry the unsent draft over. Devices name themselves (the room key already
+// trusts every linked device, so this is presentation, not authentication).
+// In-memory: a handoff is minutes-scale, and a node restart is a fine reset.
+/** Longest device label kept; they're shown in a one-line strip. */
+const LABEL_MAX = 60;
+/** Longest draft carried between devices. */
+const DRAFT_MAX = 20_000;
+/** A driver that keeps typing re-announces at most this often. */
+const REANNOUNCE_MS = 30_000;
+/** Presence older than this is forgotten. */
+const TTL_MS = 6 * 60 * 60 * 1000;
+/** A device reference from untrusted client input, or undefined. */
+export function deviceFrom(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const { id, label } = value;
+    if (typeof id !== "string" || !id.trim() || id.length > 100)
+        return undefined;
+    const name = typeof label === "string" && label.trim() ? label.trim().slice(0, LABEL_MAX) : "Another device";
+    return { id: id.trim(), label: name };
+}
+export class PresenceBook {
+    now;
+    sessions = new Map();
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    get(sessionId) {
+        this.expire();
+        return this.sessions.get(sessionId) ?? { sessionId };
+    }
+    /** A device sent input to the session. Returns the presence to broadcast when
+     *  the driver changed (or is due a re-announce), else undefined. A chat send
+     *  also consumes that device's draft, since the draft has now been sent. */
+    drove(sessionId, device, via) {
+        const at = this.now();
+        const entry = this.entry(sessionId);
+        const previous = entry.driver;
+        entry.driver = { ...device, via, at };
+        const sentDraft = via === "chat" && entry.draft?.device.id === device.id;
+        if (sentDraft)
+            entry.draft = undefined;
+        const changed = !previous || previous.id !== device.id || previous.via !== via || at - previous.at >= REANNOUNCE_MS;
+        return changed || sentDraft ? { ...entry } : undefined;
+    }
+    /** A device's unsent draft for the session (empty text clears it). */
+    draft(sessionId, device, text) {
+        const entry = this.entry(sessionId);
+        const trimmed = text.slice(0, DRAFT_MAX);
+        if (trimmed.trim())
+            entry.draft = { device, text: trimmed, at: this.now() };
+        else if (entry.draft?.device.id === device.id)
+            entry.draft = undefined;
+        return { ...entry };
+    }
+    entry(sessionId) {
+        this.expire();
+        let entry = this.sessions.get(sessionId);
+        if (!entry) {
+            entry = { sessionId };
+            this.sessions.set(sessionId, entry);
+        }
+        return entry;
+    }
+    expire() {
+        const cutoff = this.now() - TTL_MS;
+        for (const [id, entry] of this.sessions) {
+            if (entry.driver && entry.driver.at < cutoff)
+                entry.driver = undefined;
+            if (entry.draft && entry.draft.at < cutoff)
+                entry.draft = undefined;
+            if (!entry.driver && !entry.draft)
+                this.sessions.delete(id);
+        }
+    }
+}